RHSA-2026:2572HighCVSS 8.5

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.2 security update

Published
February 11, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (7)

CVE-2026-22029 →CVE-2025-7195 →CVE-2025-47907 →CVE-2025-53547 →CVE-2025-58183 →CVE-2025-61729 →CVE-2025-68156 →

📋 Description

CVE-2025-7195 — operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-53547 — helm.sh/helm/v3: Helm Chart Code Execution CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects

🎯 Affected products177

  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:29c87632fa31019f74d4b8d01d1fe31eabdf0cb87db49bb69fc8fc12121a0d59_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:7716319f7ff783dcf3d231151f71ca26fa57eee72dd5964040159253a5fd67bf_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:e3b68992983b2a9f808fddb52e1608c9d8f046ba888fad0e774840bf10af58a9_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:eee223423d271b28b0f4fb94aff179ecdbc03e3684ac3ddedcce0b6a51301dcf_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:317fb7261de51fd94279a9bab94673cd1f1c0a28b62b2302ccbd94e0135e5bc9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:4c04f0264ddc33e2669636c180d75276a21ad476a69ad35bb03098cf9baf22e1_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:633647730c32944718c20ebdab6503f46a29b155e7e82def6ecd5ff5eb164ae4_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:fe92bbc4d2da8b52a0b1730589649d899f6f5e9e7be9627944d42bdc23ba4538_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:171f22aa2d830fdbf02014e93cc32c69b4324663819309ac94eb499fe50808eb_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:9363df443eacbc994ca0203ce568b548f3d2720cbe388437327b80d54c0ae8d0_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:af2ecdd41f3343e62cc30ba9e933c9b40ad7beebe2018e036de5ce9db6b33d23_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:d387c8a88d1afd56c61c40d7c2078f4851c4b5dd7958b89bac13758b364e0bfb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:18c9cb3cdb68126e1862513cc13e6c15239f981037f2889ed4d40329dffc91be_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:7779639f22d69a90815584f51f9926e05b23a92346f1526ec925a0b9abb034d3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:9cc1a68391aabb48add35aafdd5f0d5811b6cbccf29f8a9b0762bc51fc9c3ef7_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:e086f560d13ab456daaf1772f4dac2f07564d4f5ffa96258375c3713700cab0b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:11aeef77dd7c37414f04cd4e314535f7a6b8ddd7e159d3d9742804efb42580a0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:68fe1d1b794296791d05fd62ea5be3c8976fb9c46429993b34672d68b2546be3_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:a39cecc8173e63e0b802b436672601c3815c146561bb88854dfac2373e6837b3_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:f9a5c588ca9275c59f782cee8c39ab474b5447a65147e4deceaadb0c9ab2ba8b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:868930ffef665fbee89d133000280c402fe1e031a938a6e08b0747c14f9144ef_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:a661e3e78cce23d4e8852f42ad7dffca4431e86f5cf122a5a3f0483c3bf6a9ea_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:b4337adbaca6aebab4658f0d032968a8a112d7d5a45f94dab356d0e7a95b7502_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:c178d5e931d78eccbf630c7dd4f7175d1a52f6be7f20705d7589544232bb5768_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:371b19eab4d5aec3ee55477985b762743ded690c7998e107ee9fcd321be23167_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:c519b4385dbf1e4d848d5063c84bcc58dad7ffc18a8152e972747d3e7920f7dc_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:f97bf1fb0c510db93e9fae3721b0bcf6f035db18be6a50afb1263530a18abd9b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:fe12654f91b60235cc0b83f7db90fb8b724cf4db92bec12e64cdd39b95480f9d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:93c2b30b9dde7b71ce92a3bb39e40f5c4538237e109341e0621a6c7c061bf5f3_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • +147 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In Red Hat OpenShift Container Platform, the following default configurations reduce the impact of this vulnerability. Security Context Constraints (SCCs): The default SCC, Restricted-v2, applies several crucial security settings to containers. Capabilities: drop: ALL removes all Linux capabilities, including SETUID and SETGID. This prevents a process from changing its user or group ID, a common step in privilege escalation attacks. The SETUID and SETGID capabilities can also be dropped explicitly if other capabilities are still required. allowPrivilegeEscalation: false ensures that a process cannot gain more privileges than its parent process. This blocks attempts by a compromised container process to grant itself additional capabilities. SELinux Mandatory Access Control (MAC): Pods are required to run with a pre-allocated Multi-Category Security (MCS) label. This SELinux feature provides a strong layer of isolation between containers and from the host system. A properly configured SELinux policy can prevent a container escape, even if an attacker gains elevated permissions within the container itself. Filesystem Hardening: While not a default setting, a common security practice is to set readOnlyRootFilesystem: true in a container's security context. In this specific scenario, this configuration would prevent an attacker from modifying critical files like /etc/passwd, even if they managed to gain file-level write permissions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash.

🔗 References (11)